Splunk Enterprise

How to achieve multiselect input to hide/show multiple panels?

mnj1809
Path Finder

Hello,

Panels are not showing/hiding based on the selection of the multiselect input.

<form>
<label>Multiselect input to hide/show multiple panels</label>
<search>
<query>
| makeresults
| fields - _time
| eval data="$service_tok$"
| eval condition=case(match(data,"\*"),"show_all",match(data,"Windows") AND match(data,"NIX") AND match(data,"VMWare"),"show_all",match(data,"Windows"),"Windows",match(data,"NIX"),"NIX",match(data,"VMWare"),"VMWare")
| eval show_all=case(condition="show_all","true")
| eval show_windows=case(condition="Windows" OR condition="show_all","true")
| eval show_nix=case(condition="NIX" OR condition="show_all","true")
| eval show_vmware=case(condition="VMWare" OR condition="show_all","true")
</query>
<done>
<condition match="$job.resultCount$!=0">
<eval token="tokShowAll">case(isnotnull($result.show_all$),$result.show_all$)</eval>
<eval token="tokShowWindows">case(isnotnull($result.show_windows$),$result.show_windows$)</eval>
<eval token="tokShowNIX">case(isnotnull($result.show_nix$),$result.show_nix$)</eval>
<eval token="tokShowVMWare">case(isnotnull($result.show_vmware$),$result.show_vmware$)</eval>
</condition>
<condition>
<unset token="tokShowAll"></unset>
<unset token="tokShowWindows"></unset>
<unset token="tokShowNIX"></unset>
<unset token="tokShowVMWare"></unset>
</condition>
</done>
</search>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" token="service_tok" searchWhenChanged="true">
<label>Select a Service</label>
<choice value="*">All</choice>
<choice value="Windows">Windows</choice>
<choice value="NIX">NIX</choice>
<choice value="VMWare">VMWare</choice>
<change>
<unset token="tokShowAll"></unset>
<unset token="tokShowWindows"></unset>
<unset token="tokShowNIX"></unset>
<unset token="tokShowVMWare"></unset>
</change>
<default>*</default>
<initialValue>*</initialValue>
<delimiter> </delimiter>
</input>
</fieldset>
<row>
<panel>
<title></title>
</panel>
</row>
<row depends="$tokShowWindows$">
<panel>
<table>
<title>Windows Request Count</title>
<search>
<query>host=abcd source="/access.log*" | timechart span=1hr count by host</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
<row depends="$tokShowNIX$">
<panel>
<table>
<title>NIX Request Count</title>
<search>
<query>host=abcd source="access.log" | timechart span=1hr count by host</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
<row depends="$tokShowVMWare$">
<panel>
<table>
<title>VMWare Request Count</title>
<search>
<query>host=abcd source="access.log" | timechart span=1hr count by host</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</form>

@ITWhisperer 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
<form version="1.1">
  <label>Multiselect Choice</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="alloptions" searchWhenChanged="true">
      <label></label>
      <choice value="*">All</choice>
      <choice value="second_choice">second choice</choice>
      <choice value="third_choice">third choice</choice>
      <choice value="fourth_choice">fourth choice</choice>
      <choice value="fifth_choice">fifth choice</choice>
      <delimiter>,</delimiter>
      <change>
        <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"*",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"\\*")&gt;0,"*",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"\\*")=0,mvfilter('form.alloptions'!="*"),1==1,'form.alloptions')</eval>
        <eval token="second">if(isnotnull(mvfind('form.alloptions',"second_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="third">if(isnotnull(mvfind('form.alloptions',"third_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="fourth">if(isnotnull(mvfind('form.alloptions',"fourth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="fifth">if(isnotnull(mvfind('form.alloptions',"fifth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$second$">
      <html>
        <p>Second Panel</p>
      </html>
    </panel>
    <panel depends="$third$">
      <html>
        <p>Third Panel</p>
      </html>
    </panel>
    <panel depends="$fourth$">
      <html>
        <p>Fourth Panel</p>
      </html>
    </panel>
    <panel depends="$fifth$">
      <html>
        <p>Fifth Panel</p>
      </html>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please explain what each part of the dashboard is trying to do and how it is trying to do it?

0 Karma

mnj1809
Path Finder

Thanks for your prompt response.
I just want to show and hide panels based on the selection of values in Multiselect Input. For example, If I select "Windows" in the multiselect input then only panel "Windows Request Count" should be shown and if I select "Windows" and "NIX" in the multiselect input then panels "Windows Request Count" and NIX Request Count" should be shown.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Add a change handler to the multiselect to set the appropriate tokens based on the selection.

0 Karma

mnj1809
Path Finder

As you can see in my shared dashboard xml, I've added the change handler but it's not working as expected. could you please share another solution to achieve the requirement or update my shared xml please. Please see the attached screenshot for your reference.
I've selected "Windows" and "NIX" in the multiselect input but only "Windows Request Count" panel is shown however "NIX Request Count" panel should also be shown.

@ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your change handler on the multiselect is unsetting all the tokens, it is not setting any of them based on the input selected. This is where you need to have a change handler.

<form version="1.1">
  <label>Multiselect Choice</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="alloptions" searchWhenChanged="true">
      <label></label>
      <choice value="All">All</choice>
      <choice value="second_choice">second choice</choice>
      <choice value="third_choicee">third choice</choice>
      <choice value="fourth_choice">fourth choice</choice>
      <choice value="fifth_choicee">fifth choice</choice>
      <delimiter>,</delimiter>
      <change>
        <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"All",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"All")&gt;0,"All",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"All")=0,mvfilter('form.alloptions'!="All"),1==1,'form.alloptions')</eval>
        <eval token="second">if(isnotnull(mvfind('form.alloptions',"second_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval>
        <eval token="third">if(isnotnull(mvfind('form.alloptions',"third_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval>
        <eval token="fourth">if(isnotnull(mvfind('form.alloptions',"fourth_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval>
        <eval token="fifth">if(isnotnull(mvfind('form.alloptions',"fifth_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$second$">
      <html>
        <p>Second Panel</p>
      </html>
    </panel>
    <panel depends="$third$">
      <html>
        <p>Third Panel</p>
      </html>
    </panel>
    <panel depends="$fourth$">
      <html>
        <p>Fourth Panel</p>
      </html>
    </panel>
    <panel depends="$fifth$">
      <html>
        <p>Fifth Panel</p>
      </html>
    </panel>
  </row>
</form>
0 Karma

mnj1809
Path Finder

This given solution works perfectly. But my requirement is to use value="*" for "All" as I need to use this value in other panels. could you please share the updated dashboard xml having
<choice value="*">All</choice>

@ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<form version="1.1">
  <label>Multiselect Choice</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="alloptions" searchWhenChanged="true">
      <label></label>
      <choice value="*">All</choice>
      <choice value="second_choice">second choice</choice>
      <choice value="third_choice">third choice</choice>
      <choice value="fourth_choice">fourth choice</choice>
      <choice value="fifth_choice">fifth choice</choice>
      <delimiter>,</delimiter>
      <change>
        <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"*",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"\\*")&gt;0,"*",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"\\*")=0,mvfilter('form.alloptions'!="*"),1==1,'form.alloptions')</eval>
        <eval token="second">if(isnotnull(mvfind('form.alloptions',"second_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="third">if(isnotnull(mvfind('form.alloptions',"third_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="fourth">if(isnotnull(mvfind('form.alloptions',"fourth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="fifth">if(isnotnull(mvfind('form.alloptions',"fifth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$second$">
      <html>
        <p>Second Panel</p>
      </html>
    </panel>
    <panel depends="$third$">
      <html>
        <p>Third Panel</p>
      </html>
    </panel>
    <panel depends="$fourth$">
      <html>
        <p>Fourth Panel</p>
      </html>
    </panel>
    <panel depends="$fifth$">
      <html>
        <p>Fifth Panel</p>
      </html>
    </panel>
  </row>
</form>
0 Karma

mnj1809
Path Finder

Thank you so much. Works perfectly !!!
@ITWhisperer 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...